@aiwg/cli 2026.9.19 → 2026.9.21

package/schemas/security/pr-evidence-receipt.v1.schema.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/security/pr-evidence-receipt.v1.schema.json",
+  "title": "PullRequestEvidenceReceipt",
+  "type": "object",
+  "required": ["schemaVersion", "head", "base", "acquiredAt", "completedAt", "body", "collection", "paths", "completeness", "scopeTriage", "maliciousness", "claims", "verified", "assessed", "evidenceManifest", "nextAction", "actionTrail", "sha256"],
+  "properties": {
+    "schemaVersion": { "const": "1" },
+    "repository": { "type": "string" },
+    "number": { "type": "integer" },
+    "head": { "type": "string", "pattern": "^[0-9a-fA-F]{40,64}$" },
+    "base": { "type": "string", "pattern": "^[0-9a-fA-F]{40,64}$" },
+    "acquiredAt": { "type": "string", "format": "date-time" },
+    "completedAt": { "type": "string", "format": "date-time" },
+    "body": {
+      "type": "object",
+      "required": ["current", "history"],
+      "properties": {
+        "current": {
+          "type": "object",
+          "required": ["text", "sha256"],
+          "properties": {
+            "text": { "type": "string" },
+            "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+          }
+        },
+        "history": { "type": "array" }
+      }
+    },
+    "collection": { "type": "object" },
+    "paths": { "type": "array" },
+    "completeness": {
+      "type": "object",
+      "required": ["complete", "omissions"],
+      "properties": {
+        "complete": { "type": "boolean" },
+        "omissions": { "type": "array", "items": {
+          "type": "object", "required": ["surface", "reason", "nextStep"],
+          "properties": { "surface": { "type": "string" }, "reason": { "type": "string" }, "nextStep": { "type": "string" } }
+        } }
+      }
+    },
+    "scopeTriage": { "type": "object" },
+    "maliciousness": { "type": "object" },
+    "codeOrigin": { "type": "object" },
+    "claims": { "type": "object" },
+    "verified": { "type": "object" },
+    "assessed": { "type": "array", "items": {
+      "type": "object", "required": ["id", "surface", "sha256", "report"],
+      "properties": {
+        "id": { "type": "string" },
+        "surface": { "enum": ["pull-request-title", "pull-request-body", "pull-request-diff-summary", "review-comment"] },
+        "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "report": { "type": "object" }
+      }
+    } },
+    "activeFindings": { "type": "array" },
+    "evidenceManifest": { "type": "array", "items": {
+      "type": "object", "required": ["sourceId", "sha256", "revision"],
+      "properties": {
+        "sourceId": { "type": "string" }, "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "revision": { "type": "string" }, "lineCoverage": { "type": "object" }
+      }
+    } },
+    "nextAction": {
+      "type": "object",
+      "required": ["proposed", "gate", "reason"],
+      "properties": {
+        "proposed": { "type": "string" },
+        "gate": { "type": "string" },
+        "reason": { "type": "string" }
+      }
+    },
+    "actionTrail": { "type": "array", "minItems": 1 },
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+  }
+}

package/schemas/security/threat-assessment-report.v1.schema.json

@@ -16,8 +16,10 @@
     "source",
     "actor",
     "requestedAction",
+    "authorization",
     "policyProvenance",
     "assessed",
+    "completeness",
     "findings",
     "risk",
     "decision"
@@ -36,6 +38,20 @@
     "source": { "type": "object", "additionalProperties": true },
     "actor": { "type": "object", "additionalProperties": true },
     "requestedAction": { "type": "string" },
+    "authorization": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["required", "checkpoint", "verified", "contentHash", "provenance", "reasons"],
+      "properties": {
+        "required": { "type": "boolean" },
+        "checkpoint": { "type": "string", "minLength": 1 },
+        "verified": { "type": "boolean" },
+        "contentHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "provenance": { "type": "object", "additionalProperties": true },
+        "receiptId": { "type": "string" },
+        "reasons": { "type": "array", "uniqueItems": true, "items": { "type": "string" } }
+      }
+    },
     "policyProvenance": {
       "type": "object",
       "additionalProperties": false,
@@ -46,6 +62,42 @@
       }
     },
     "assessed": { "type": "boolean" },
+    "completeness": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["complete", "reasons", "limits", "observed"],
+      "properties": {
+        "complete": { "type": "boolean" },
+        "reasons": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "enum": ["part-limit", "input-character-limit", "occurrence-limit", "finding-limit"] }
+        },
+        "limits": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["maxInputCharacters", "maxParts", "maxOccurrencesPerPattern", "maxFindings", "maxCustomRules", "maxPatternsPerRule"],
+          "properties": {
+            "maxInputCharacters": { "type": "integer", "minimum": 1 },
+            "maxParts": { "type": "integer", "minimum": 1 },
+            "maxOccurrencesPerPattern": { "type": "integer", "minimum": 1 },
+            "maxFindings": { "type": "integer", "minimum": 1 },
+            "maxCustomRules": { "type": "integer", "minimum": 1 },
+            "maxPatternsPerRule": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "observed": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["parts", "characters", "findings"],
+          "properties": {
+            "parts": { "type": "integer", "minimum": 0 },
+            "characters": { "type": "integer", "minimum": 0 },
+            "findings": { "type": "integer", "minimum": 0 }
+          }
+        }
+      }
+    },
     "findings": {
       "type": "array",
       "items": { "$ref": "#/definitions/finding" }
@@ -84,7 +136,7 @@
     "finding": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["ruleId", "ruleProvenance", "severity", "likelihood", "impact", "taxonomy", "partId", "context", "evidence", "suppressed", "matchedStatements"],
+      "required": ["ruleId", "ruleProvenance", "severity", "likelihood", "impact", "taxonomy", "partId", "occurrence", "context", "evidence", "suppressed", "matchedStatements"],
       "properties": {
         "ruleId": { "type": "string" },
         "ruleProvenance": { "type": "string" },
@@ -93,6 +145,24 @@
         "impact": { "type": "number", "minimum": 1, "maximum": 5 },
         "taxonomy": { "type": "array", "items": { "type": "string" } },
         "partId": { "type": "string" },
+        "occurrence": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["start", "end", "match", "paragraphStart", "paragraphEnd", "patternIndexes"],
+          "properties": {
+            "start": { "type": "integer", "minimum": 0 },
+            "end": { "type": "integer", "minimum": 0 },
+            "match": { "type": "string" },
+            "paragraphStart": { "type": "integer", "minimum": 0 },
+            "paragraphEnd": { "type": "integer", "minimum": 0 },
+            "patternIndexes": {
+              "type": "array",
+              "minItems": 1,
+              "uniqueItems": true,
+              "items": { "type": "integer", "minimum": 0 }
+            }
+          }
+        },
         "context": { "enum": ["requested", "negative", "quoted", "documentation", "descriptive", "orchestrator-status"] },
         "source": { "type": "object", "additionalProperties": true },
         "evidence": { "type": "string" },

package/tools/agents/deploy-agents.mjs

@@ -20,7 +20,7 @@
  *   --rules-only             Deploy only rules (skip agents)
  *   --dry-run                Show what would be deployed without writing
  *   --force                  Overwrite existing files
- *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, grok-build, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
+ *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, grok-build, muse, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
  *   --model <name>            Override model for all tiers (blanket)
  *   --reasoning-model <name> Override model for reasoning tasks
  *   --coding-model <name>    Override model for coding tasks
@@ -123,7 +123,7 @@ const PROVIDER_ALIASES = {
   'dsh': 'deepseek-harness',
 };
 
-const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman', 'grokbot', 'grok-build'];
+const AVAILABLE_PROVIDERS = ['antigravity', 'claude', 'factory', 'codex', 'opencode', 'copilot', 'cursor', 'pi', 'omp', 'deepseek-harness', 'warp', 'windsurf', 'hermes', 'openclaw', 'openhuman', 'grokbot', 'grok-build', 'muse'];
 
 const UNSUPPORTED_PROVIDER_HINTS = {
   'devin-cli': [
@@ -512,7 +512,9 @@ function parseArgs() {
     // stale copies of packaged ones.
     deploySource: null,           // Managed-marker source; defaults to 'bundled'
     listingBudget: false,         // Honor the provider startup-listing cap despite --copy-all (#2561)
-    deployVersion: null           // Managed-marker version; defaults to srcRoot package.json
+    deployVersion: null,          // Managed-marker version; defaults to srcRoot package.json
+    mcp: false,                   // #228: opt-in MCP settings profile (Muse provider)
+    hooks: true,                  // #228: managed project hooks (Muse provider); --no-hooks opts out
   };
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
@@ -549,6 +551,10 @@ function parseArgs() {
     // Structural opt-out: skip the migration without claiming the operator declined it (#2541).
     else if (a === '--no-commands-warning') cfg.warnOnSkippedCommandsMigration = false;
     else if (a === '--copy-all' || a === '--copy-standard-skills') cfg.copyStandardSkills = true;
+    // #228: Muse provider — explicit opt-in MCP settings profile, and the
+    // managed-hooks opt-out (default on, mirroring the Claude autoInstall policy).
+    else if (a === '--mcp') cfg.mcp = true;
+    else if (a === '--no-hooks') cfg.hooks = false;
     else if (a === '--deploy-source' && args[i + 1]) cfg.deploySource = String(args[++i]);
     else if (a === '--listing-budget') cfg.listingBudget = true;
     else if (a === '--deploy-version' && args[i + 1]) cfg.deployVersion = String(args[++i]);
@@ -591,6 +597,11 @@ Options:
   --filter-role <role>     Only deploy agents of role: reasoning|coding|efficiency
   --save                   Save model config to project models.json
   --save-user              Save model config to ~/.config/aiwg/models.json
+  --mcp                    Muse provider: opt in to the AIWG MCP settings profile
+                           (merges the aiwg stdio server into user settings
+                           mcp_servers; default off)
+  --no-hooks               Muse provider: skip managed project hooks
+                           (.muse/hooks.json; installed by default)
   --as-agents-md               Aggregate to single AGENTS.md (Codex)
   --create-agents-md           Create/update AGENTS.md template
   --skip-commands-migration    Skip deleting the commands directory before skills deployment
@@ -618,7 +629,7 @@ Model Override Examples:
   aiwg use sdlc --reasoning opus --coding sonnet --efficiency haiku
 
   # Use a specific model ID for coding tier
-  aiwg use sdlc --provider factory --coding-model gpt-5.3-codex
+  aiwg use sdlc --provider factory --coding-model gpt-5.6-terra
 
   # Blanket with per-tier override (reasoning uses opus, others use sonnet)
   aiwg use sdlc --model sonnet --reasoning opus
@@ -653,6 +664,7 @@ Providers (all deploy agents, commands, skills, and rules):
               Paths: .windsurf/agents/, .windsurf/workflows/, .windsurf/skills/, .windsurf/rules/
   grokbot   - Grok Bot (AGENTS.md bridge; skills only with AIWG_GROKBOT_SKILLS_DIR)
   grok-build - Grok Build (experimental; .grok paths + $GROK_HOME; no bare grok alias)
+  muse      - Muse Code (experimental; AGENTS.md bridge; .agents/skills + XDG user root; managed hooks, opt-in --mcp; no aliases)
   hermes    - Hermes Agent (MCP-based integration)
               Skills: $HERMES_HOME/skills/ (user-global; defaults to ~/.hermes/skills/) | Agents: AGENTS.md
               Commands/Rules: served via MCP, not file-deployed
@@ -736,8 +748,8 @@ async function loadProvider(providerName) {
  * If the value is a known shorthand (opus, sonnet, haiku, inherit), resolve it
  * through the provider's shorthand map. Otherwise treat it as a literal model ID.
  *
- * @param {string|null} value - CLI flag value (e.g., "opus" or "claude-opus-4-6")
- * @param {object} shorthandMap - Provider shorthand map (e.g., { opus: "claude-opus-4-6" })
+ * @param {string|null} value - CLI flag value (e.g., "opus" or "claude-opus-5")
+ * @param {object} shorthandMap - Provider shorthand map (e.g., { opus: "claude-opus-5" })
  * @param {object} modelsConfig - Full models config from loadModelConfig()
  * @param {string} provider - Provider name
  * @param {string} tier - Tier name: "reasoning", "coding", or "efficiency"
@@ -1024,6 +1036,9 @@ export async function main() {
     // Replaces the legacy AIWG_COPY_STANDARD_SKILLS env var (removed rc.30).
     // Default (#1217) is no-copy + index-driven discovery.
     copyStandardSkills: cfg.copyStandardSkills === true,
+    // #228: Muse provider hooks/MCP profile surface.
+    mcp: cfg.mcp === true,
+    hooks: cfg.hooks !== false,
     listingBudget: cfg.listingBudget === true,
     deployVersion: cfg.deployVersion || getDeployVersion(srcRoot),
     deploySource: cfg.deploySource || 'bundled',

package/tools/agents/providers/base.mjs

@@ -306,8 +306,8 @@ export function loadModelConfig(srcRoot) {
   // Fallback to hardcoded defaults if no config found
   return {
     claude: {
-      reasoning: { model: 'claude-opus-4-7' },
-      coding: { model: 'claude-sonnet-4-6' },
+      reasoning: { model: 'claude-opus-5' },
+      coding: { model: 'claude-sonnet-5' },
       efficiency: { model: 'claude-haiku-4-5' }
     },
     factory: {
@@ -316,8 +316,8 @@ export function loadModelConfig(srcRoot) {
       efficiency: { model: 'light' }
     },
     shorthand: {
-      'opus': 'claude-opus-4-7',
-      'sonnet': 'claude-sonnet-4-6',
+      'opus': 'claude-opus-5',
+      'sonnet': 'claude-sonnet-5',
       'haiku': 'claude-haiku-4-5',
       'inherit': 'inherit'
     },
@@ -2269,6 +2269,9 @@ export function discoverAddons(srcRoot) {
 
     // Skip addons marked devOnly — they are contributor tools, not end-user deployables
     if (manifest.devOnly === true) continue;
+    // explicitInstall addons deploy only when named (`aiwg use <addon>`), never
+    // as part of a framework or `all` bulk deploy (#2641).
+    if (manifest.explicitInstall === true) continue;
 
     addons.push({
       name: entry.name,

package/tools/agents/providers/codex.mjs

@@ -20,7 +20,7 @@
  *   `.agents/skills/` only and prune the stale legacy home dir on deploy.
  *
  * Special features:
- *   - Model replacement (opus/sonnet/haiku -> gpt-5.4/gpt-5.5/gpt-5.4-mini)
+ *   - Model replacement (opus/sonnet/haiku -> catalog codex roles (gpt-5.6-sol/terra/luna))
  *   - --as-agents-md aggregation option
  *   - Delegates commands to deploy-prompts-codex.mjs (deploys to ~/.codex/prompts/)
  *   - Delegates skills to deploy-skills-codex.mjs (deploys to .agents/skills/)

package/tools/agents/providers/grok-build.d.mts

@@ -0,0 +1,7 @@
+export interface GrokBuildUninstallReport {
+  planned: string[];
+  removed: string[];
+  skipped: string[];
+}
+
+export function uninstall(target: string, opts: { dryRun?: boolean; srcRoot: string }): GrokBuildUninstallReport;